Vulnerabilities

Criminals pay top money for hackable Nokia phone

From IDG News (Jeremy Kirk)

Criminals are willing to pay thousands of euros for a discontinued Nokia mobile phone with a software problem that can be exploited to hack into online bank accounts [cio.com], according to a fraud investigator in the Netherlands.

About 10 days ago, investigators observed someone transfer €25,000 (US$32,413) for a Nokia 1100 phone, said Frank Engelsman of Ultrascan Advanced Global Investigations. The candy-bar style phone is one of Nokia’s all-time best-selling models, and originally sold for under €100. Read the full story [cio.com]

Mac OS X malware turns into DoS botnet

Multiple news outlets [ZDNet, CBC, The Register and Washington Post] are reporting on what appears to be the first malicious botnet made up only of machine’s running Apple’s Mac operating system.
The botnet is directly linked to a previously known Trojan that was embedded into pirated copies of Apple’s iWorks program.  It was being used in the past to launch denial-of-service attacks.  The full analysis of the botnet is available at Virus Bulletin [subscription required]

Security budget issues to resonate at RSA Conference

From SearchSecurity (Robert Westervelt)
The glum economy has put increased pressure on CISOs to cut costs while maintaining the same security defenses. Tightening budgets, coupled with increased compliance demands could have security professionals looking for answers next week at the 2009 RSA Conference. Read the full story [searchsecurity.com]

Researcher may have method for running shellcode on iPhones

by Dennis Fisher

From Computerworld (Jeremy Kirk)
Apple security whiz Charlie Miller has discovered a method that may enable attackers to run shellcode on the latest version of the Apple iPhone, something that researchers previously thought to be impossible. In a presentation at Black Hat Europe this week, Miller discussed his findings, but said that in order to get the shellcode working, an attacker would still need an exploit.

Microsoft to unveil patch management metrics project

by Dennis Fisher

Microsoft on Wednesday plans to launch a new research effort to determine the total cost of the patch-management cycle, from testing and distributing a fix to user deployment of the patch. The end result of the project, which will be completely open and transparent to outsiders, will be a full metrics model that the company plans to make freely available.

Microsoft plugs gaping holes in IE, Excel, Windows

by Ryan Naraine

Microsoft today released its April batch of security patches:  8 bulletins with patches for at least 20 documented holes in popular software products.  The most serious of the flaws could lead to remote code execution attacks that give a malicious hacker complete ownership of a vulnerable machine. 

1 in 5 Windows PCs still hackable by Conficker

by Ryan Naraine

From Computerworld (Gregg Keizer)
Although the media blitz about the Conficker worm prompted a significant number of enterprise users to finally fix a six-month-old Windows bug, about one in five business computers still lack the patch [computerworld.com], a security company said today.
Scans of more than 300,000 Windows PCs owned by customers of Qualys Inc. show that patching of the MS08-067 vulnerability — a bug that Microsoft fixed with an emergency update issued in October 2008 — picked up dramatically two weeks ago. Read the full story. Also see our previous coverage of the Conficker threat.

Targeted attacks use ‘Recession Relief’ theme

by Ryan Naraine

Internet fraudsters are increasingly taking advantage of the deepening recession to dupe unsuspecting email recipients. The e-mail often includes a request for personal details on the pretense of receiving some financial reward, which later leads to fraud.
Common themes include prize wins, inheritance claims, money mule schemes and, increasingly, recession-beating scams.  Read the full story [websense.com]

After attacks, Microsoft readies security patches

by Ryan Naraine

From CIO (Robert McMillan)
Corporate IT staffers will get a double whammy next week, as both Microsoft and Oracle are set to release critical security updates [cio.com] on the same day, including a likely fix for an Excel bug that has been used by cybercriminals.
This month, Oracle’s quarterly software fixes and Microsoft’s monthly patches happen to fall on the same day, next Tuesday. For Windows users, there will be a lot to patch. Microsoft plans to release eight updates in total [microsoft.com]: Five of them are for Windows, with a single update each for Internet Explorer, Excel and Microsoft’s Internet Security and Acceleration (ISA) server. Read the full story.  More from ZDNet Zero Day [zdnet.com]

Cybersecurity for your growing business
Cybersecurity for your growing business

Topics

Show all

Authors

Threatpost

InfoSec Insider

Infosec Insider Post

Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Content

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.